1. Desktop and Server OS Vulnerabilities

2. Topics
examines how security testing is used to analyze an OS for vulnerabilities and correct them.
explore techniques and best practices for hardening OSs and services.

3. Windows OS Vulnerabilities
Many Windows OSs have serious vulnerabilities.
In Windows 2000 and earlier
several services and features are unsecured and open for access
administrators must disable, reconfigure, or uninstall these services and features to lessen the vulnerability to attack.
In Windows XP, Vista, Server 2003, Server 2008, and Windows 7
most services and features are disabled by default.
administrators must configure them to be available, or users can’t access needed resources.
In other words, security is tighter in these updated versions, but users can’t do their jobs. An entire chapter could be devoted to this problem, but for this chapter, you just need to know that default installations of Windows OSs can contain serious vulnerabilities that attackers exploi

4. Windows OS Vulnerabilities
To determine vulnerabilities for any OS, you can check the CVE Web site (
how a vulnerability in one OS version also applies to newer versions.
The default installations of Windows OSs can contain serious vulnerabilities that attackers exploit.

5. Windows Server 2008 vulnerabilities found at CVE
CVE/CAN
Description
CVE
Windows XP, Server 2003 and 2008, and Vista allow local users to access sensitive information because of a program error in Task Manager.
CVE
The Telnet service in Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote Telnet servers to run arbitrary code on a client machine. In other words, the attacker can take control of the remote system.
CVE
Vulnerabilities in Microsoft’s TCP/IP implementation in Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 allow remote attackers to run arbitrary code, which could enable them to access the system.

6. Approach
Security testers can use information from the CVE site to test a Windows computer and make sure it’s been patched with updates from Microsoft that address these known vulnerabilities.
Hackers visit Web sites that offer exploit programs to run against these vulnerabilities, but launching exploits is not your job.
Many of these known vulnerabilities use ports that port-scanning tools can easily detect as being open. For example, NNTP (port 119), SMTP (port 25), and RPC (port 135) might be vulnerable to attack.
Many of the explanations at the CVE Web site are complex and might be difficult to understand. What’s important, however, is that you’re able to research a vulnerability that’s relevant to the security test you’re conducting. For example, if the system you’re testing uses the Remote Desktop Connection client noted in CVE , you might need to do research on what Remote Desktop Connection is and whether the version the company is running is vulnerable. You might also have to visit the Microsoft Web site to see whether any patches or security updates are available for this vulnerability. For example, searching on “Remote Desktop Connection vulnerability” at the Microsoft Web site reveals the following: “Microsoft Security Bulletin MS Critical Vulnerabilities in Remote Desktop Connection Could Allow Remote Code Execution (970927).” Information about the vulnerability and links to download the patches are provided at

7. Windows File Systems
The purpose of any file system, regardless of the OS, is to store and manage information.
The file system organizes information that users create as well as the OS files needed to boot the system.
In some cases, this critical component of the OS can be a vulnerability.

8. File Allocation Table (FAT)
Original Microsoft file system (nearly all desktop and server Oss)
FAT12 is the standard file system for most removable media other than CDs and DVDs.
Later versions, such as FAT16, FAT32, and Extended FAT (exFAT, developed for Windows Embedded CE), provide for larger file and disk sizes.

9. File Allocation Table (FAT)
For example, FAT32 allows a single file to be up to 4 GB and a disk volume to be up to 8 terabytes (TB).
The most serious shortcoming of FAT is that it doesn’t support file-level access control lists (ACLs), which are necessary for setting permissions on files.
For this reason, using FAT in a multiuser environment results in a critical vulnerability.
Microsoft addressed this problem and other shortcomings of FAT when it introduced its first OS for enterprises, Windows NT.

10. New Technology File System (NTFS)
was first released as a high-end file system in Windows NT 3.1, and in Windows NT 3.51,
it added support for larger files and disk volumes as well as ACL file security.
Subsequent Windows versions have included upgrades for compression, disk quotas, journaling, file-level encryption, transactional NTFS, symbolic links, and self-healing.
Even with strong security features, NTFS has some inherent vulnerabilities.

11. Remote Procedure Call (RPC)
An interprocess communication mechanism that allows a program running on one host to run code on a remote host.
Microsoft Baseline Security Analyzer (MBSA) is a set of tools for Identifying Vulnerabilities in Windows
An excellent tool for determining whether a system is vulnerable to RPC-related issue.

12. Case
The Conficker worm took advantage of a vulnerability in RPC to run arbitrary code on susceptible hosts.
Microsoft Security Bulletin MS08-067, posted October 23, 2008, advised users of this critical vulnerability
allowed attackers to run their own code
a patch was available weeks before the Conficker worm hit on November 21, 2008, millions of computers were affected.

13. NetBIOS
NetBIOS is software loaded into memory that enables a program to interact with a network resource or device.
Network resources are identified with 16-byte NetBIOS names.
NetBIOS isn’t a protocol; it’s just the interface to a network protocol that enables a program to access a network resource.
It usually works with NetBIOS Extended User Interface (NetBEUI), a fast, efficient protocol that requires little configuration and allows transmitting NetBIOS packets over TCP/IP and various network topologies, such as token ring and Ethernet. NetBIOS over TCP/IP is called NBT in Windows 2000 Server; in Windows Server 2003, it’s called NetBT. (NetBIOS isn’t available in Windows Vista, Server 2008, and later versions of Windows.)

14. NetBIOS
Systems running newer Windows OSs can share files and resources without using NetBIOS
NetBIOS is still used for backward compatibility
NetBIOS isn’t available in Windows Vista, Server 2008, and later versions of Windows
Therefore, software developers face the challenge of improving OS security yet still ensuring compatibility with less secure predecessors.

15. Server Message Block (SMB)
To share files and usually runs on top of NetBIOS, NetBEUI, or TCP/IP.
Several hacking tools that target SMB can still cause damage to Windows networks.
L0phtcrack’s SMB Packet Capture utility and
SMBRelay, which intercept SMB traffic and collect usernames and password hashes
Problem caused by ensuring backward compatibility. By continuing to use a protocol with a known vulnerability Microsoft exposes its products to attack and exploitation.
Microsoft introduced SMB2 in Windows Vista, and this version has several new features and is faster and more efficient.
In addition, in Windows 7, Microsoft avoided reusing code from Windows XP in the OS but still allowed backward capability by including an option for a virtualized Windows XP environment, called Windows XP Mode

16. Common Internet File System (CIFS)
CIFS is a remote file system protocol that enables computers to share network resources over the Internet.
A protocol that replaced SMB in Windows 2000 Server and later,
For backward compatibility, the original SMB is still used.
files, folders, printers, and other resources can be made available to users throughout a network.
For sharing to occur, there must be an infrastructure that allows placing these resources on the network and a method to control access to resources. CIFS relies on other protocols to handle service announcements notifying users what resources are available on the network and to handle authentication and authorization for accessing these resources. CIFS is also available for many *nix systems.

17. Common Internet File System (CIFS)
The Network Neighborhood or My Network Places services use broadcast protocols to announce resources available on a network.
a computer calls over the network connection and announces its NetBIOS name and files and folders to share with anyone out there
To prevent unauthorized access to these files, CIFS relies on SMB’s security model. An administrator can select two methods for server security:
Share-level security —A folder on a disk is made available to users for sharing. A password can be configured for the share but isn’t required.
User-level security —The resource is made available to network users; however, a username and password are required to access the resource. The SMB server maintains an encrypted version of users’ passwords to enhance security.
Windows 2000 Server and later listen on most of the same ports as Windows NT, which means many old attacks might still work on newer OSs. For example, by recognizing which ports are open on a Windows Server 2003 or 2008 system, a security tester can find vulnerabilities that allow introducing a Trojan or other remote control program for capturing authorized users’ passwords and logon names. Most attackers look for servers designated as domain controllers (servers that handle authentication). Windows Server 2003 and 2008 domain controllers are used to authenticate user accounts, so they contain much of the information attackers want to access. By default, Windows Server 2003 and 2008 domain controllers using CIFS listen on the following ports:
DNS (port 53)
HTTP (port 80)
Kerberos (port 88)
RPC (port 135)
NetBIOS Name Service (port 137)
NetBIOS Datagram Service (port 139)
LDAP (port 389)
HTTPS (port 443)
SMB/CIFS (port 445)
LDAP over SSL (port 636)
Active Directory global catalog (port 3268)
In Windows Server 2003 and 2008, a domain controller uses a global catalog (GC) server to locate resources in a domain containing thousands or even millions of objects. For example, if a user wants to locate a printer with the word “color” in its description, he or she can use a GC server, which contains attributes such as the resource’s name and location and points the user to the network resource.

18. Null Sessions
an anonymous connection established without credentials, such as a username and password (anonymous logon).
only required if networks need to support older Windows versions.
can use the Nbtstat, Net view, Netstat, Ping, and Telnet commands to enumerate NetBIOS vulnerabilities.

19. Web Services
Many Windows services leave systems vulnerable to attack, Web services and IIS in particular.
Microsoft developed the IIS Lockdown Wizard specifically for locking down IIS versions 4.0 and 5.0.
You can download it from
should encourage clients to upgrade any OS that’s no longer supported instead of using security workarounds, such as the IIS Lockdown Wizard.

20. Web Services IIS 5.0 is installed by default in Windows 2000 Server,
don’t assume there’s no Web server on your network just because you didn’t specifically install one.

21. Web Services
IIS 6.0 (Windows Server 2003) and IIS 7.0 (Windows Server 2008) installed in a “secure by default”
Regardless of the IIS version a system runs, keeping systems patched is important, and should be aware of what patches are installed and which services are running on their Web servers.

22. SQL Server
has many potential vulnerabilities that can’t be covered in detail in this book.
The most common critical SQL vulnerability is the null SA password.
All versions before SQL Server 2005 have a vulnerability that could allow remote users to gain System Administrator (SA) access through the SA account on the server.
During SQL Server 6.5 and 7 installations, the user is prompted—but not required—to set a password on this account.
SQL Server 2000 uses Windows Integrated authentication by default, but the user can also select mixed-mode authentication. In this authentication mode, an SA account with a blank password is created, and this account can’t be disabled. If attackers find this account, they have administrative access to not only the database, but also potentially the database server.

23. Passwords and Authentication
the weakest security link in any network is authorized users.
Unfortunately, this link is the most difficult to secure, as it relies on people who might not realize that their actions could expose their organization to a major security breach

24. Passwords and Authentication
A comprehensive password policy is critical, as a username and password are often all that stands between an attacker and access. A password policy should include the following:
Change passwords regularly on system-level accounts (every 60 days at minimum).
Require users to change their passwords regularly (at least quarterly).
Require a minimum password length of at least eight characters (and 15 characters for administrative accounts).
Require complex passwords; in other words, passwords must include letters, numbers, symbols, punctuation characters, and preferably both uppercase and lowercase letters.
Passwords can’t be common words, words found in the dictionary (in any language), or slang, jargon, or dialect.
Passwords must not be identified with a particular user, such as birthdays, names, or company-related words.
Never write a password down or store it online or in a file on the user’s computer.
Don’t hint at or reveal a password to anyone over the phone, in , or in person.
Use caution when logging on to make sure no one sees you entering your password.
Limit reuse of old passwords.

25. Passwords and Authentication
administrators can configure domain controllers to enforce password age, length, and complexity.
On Windows 2000 Server, Server 2003, or Server 2008 domain controllers, some aspects of a password policy can be enforced, such as the following:
Account lockout threshold —Set the number of failed attempts before the account is disabled temporarily.
Account lockout duration —Set the period of time the user account is locked out after a specified number of failed logon attempts.
Despite the best efforts to promote security by enforcing password policies, it’s still entirely possible that a password can be cracked. The latest tools that incorporate rainbow tables can crack complex passwords surprisingly fast.

26. Activity 8.1: Downloading and Installing MBSA Time Required: 30 minutes
Objective: Download and install Microsoft Baseline Security Analyzer.
Description: In this activity, you download and install MBSA, a helpful tool for discovering vulnerabilities in Windows systems.
In Windows, start your Web browser and go to
Click the link for downloading the latest version of MBSA.
Click the Download Now link, and then click the link under the Download Now heading. Scroll down and click the Download button next to your Windows version (usually MBSASetup-x86-EN.msi unless you’re running Windows x64).
After the download is finished, browse to the location of the saved file and double-click the setup executable file. If you see a warning message, click Run or OK to continue. The MBSA Setup Wizard starts.
After closing all running Windows applications, click Next.
Click the I accept the license agreement option button, and then click Next.
Follow the prompts, accepting the default settings.
When the installation is finished, start MBSA by clicking Start, pointing to All Programs, and clicking Microsoft Baseline Security Analyzer or by double-clicking the desktop icon, if available.
Take some time to explore the interface and familiarize yourself with the program. Leave MBSA running for the next activity.

27. Tools for Identifying Vulnerabilities in Windows
Using more than one tool for analysis is advisable,
Popular OS vulnerability scanners include eEye Retina, Tenable Nessus, Qualys-Guard, GFI Languard, and IBM Internet Scanner as well as OpenVAS
All these products scan both Linux and Windows OSs.

28. Built-in Windows Tools
Microsoft Baseline Security Analyzer (MBSA),
This tool is capable of checking for patches, security updates, configuration errors, blank or weak passwords, and more.
Show what it can scan for.

29. Best Practices for Hardening Windows Systems
A security breach is only one undiscovered vulnerability away, but with careful management, most systems can be secured adequately and still meet users’ needs.
There are some general things you can do to make and keep a network secure.
As a penetration tester, your job is simply to find vulnerabilities and report them as defined in your contract. Your responsibility ends there. However, a security tester must not only find vulnerabilities; he or she must be familiar with methods of correcting them. Typically, managers want solutions included with reports of potential problems, particularly for technologies they might not fully understand.

30. Patching Systems Patch management very important
Microsoft’s Systems Management Server (SMS) can manage security patches for all computers on your network. This service assesses machines in a defined domain and can be configured to manage patch deployment.
Windows Software Update Services (WSUS), a client/server technology designed to manage patching and updating system software from the network.
Third-party patch management solutions are also available from vendors such as Symantec, McAfee, Shavlik, and HP.
The best way to keep systems secure, operating at peak performance, and using the newest features is to keep systems under your care up to date. As noted, many attacks have taken advantage of a known vulnerability that has a patch available. There are several methods for obtaining service packs, hotfixes, and patches. If you have only a few computers to maintain (10 or fewer), accessing Windows Update manually from each computer works fine, but this method is still time consuming. Depending on the Windows version, you can configure Automatic Updates on each machine. This option is usually better because it helps ensure that machines are always up to date without the administrator or user’s intervention. The downside is that some patches can cause problems, so testing a patch before applying it to a production system is preferable, particularly in large networks.
For a large network, applying updates manually isn’t feasible. Configuring Automatic Updates is an option if you have physical access to all computers, but downloading patches to each machine can slow network performance. There are a couple of options for patch management. Microsoft’s Systems Management Server (SMS) can manage security patches for all computers on your network. This service assesses machines in a defined domain and can be configured to manage patch deployment. (Although this service has many other capabilities, for the purposes of this chapter, you simply need to know that it can be used for patch management.)
Another option is Windows Software Update Services (WSUS), a client/server technology designed to manage patching and updating system software from the network. Instead of downloading updates to each computer, WSUS downloads patches and publishes them internally to servers and desktop systems. Unlike Automatic Updates, which downloads and installs updates automatically, the administrator has control over which updates are deployed. This feature is a major advantage, considering that some updates can cause problems with certain network and application configurations and should be tested before being deployed.
Third-party patch management solutions are also available from vendors such as Symantec, McAfee, Shavlik, and HP. Whatever patch-management technique is the best fit, remember that keeping systems up to date is one of the most critical steps in keeping systems secure. As a security tester, often you’ll find that patches aren’t current on the system you’re testing. An effective patch-management scheme might seem like common sense, but administrators often get so busy with other complicated issues that they forget the simple solutions. You must recommend effective patch management to your clients and be able to explain why it’s crucial to system security.

31. Antivirus Solutions
antivirus tool is that it must be planned, installed, and configured correctly to ensure the best protection.
is almost useless if it isn’t updated regularly. Ideally, an antivirus tool should automatically download and install updates daily.

32. Enable Logging and Review Logs Regularly
Logging is an important step for monitoring many crucial areas, including performance, traffic patterns, and possible security breaches.
A log-monitoring tool is best for this task. Several are available.

33. Disable Unused Services and Filtering Ports
An example, if you have a Windows Server 2008 system acting as a file server, you certainly don’t need DNS services running on it; doing so leaves port 53 TCP/UDP open and vulnerable to attack.
Open only what needs to be open, and close everything else—also known as reducing the attack surface. (The attack surface is the amount of code a computer system exposes to unauthenticated outsiders

34. Some ports frequently subject to attack include the following:
FTP (20 and 21 TCP)
TFTP (69 UDP)
Telnet (23 TCP)
DNS (53 TCP/UDP)
NNTP (119 TCP)
NetBIOS (135 TCP/UDP, 137 and 138 UDP, 139 TCP)
Windows 2000 NetBIOS (445 TCP/UDP)
Remote Desktop Protocol (3389 TCP)
SNMP (161 and 162 TCP/UDP)
Windows RPC programs (1025 to 1039 TCP/UDP)

35. Other Security Best Practices
In addition to keeping software up to date, running antivirus tools, and disabling services, you can take the following steps to help minimize the risks to a Windows network:
Delete unused scripts and sample applications.
Delete default hidden shares and unnecessary shares.
Use a different unique naming scheme and passwords for public interfaces.
Be careful of default permissions.

36. Use open-source or commercial tools to assess system security.
Use a file-integrity checker to monitor unauthorized file system modifications and send alerts of these changes.
Disable the Guest account.
Rename the default Administrator account.
Make sure there are no accounts with blank passwords. A good password policy is crucial.
Use Windows group policies to enforce security configurations on large networks efficiently and consistently.
Develop a comprehensive security awareness program for users to reinforce your organization’s security policy.
Keep up with emerging threats. Check with Microsoft, SANS, US-CERT ( and other security organizations for the newest developments.

37. Linux OS Vulnerabilities
Too many network administrators believe Windows is easier to attack and view *nix OSs as inherently more secure.
making these assumptions can be dangerous because vulnerabilities exist for all OSs.
When conducting a security test on systems running Linux, you should follow the same rules you would for any OS.
Like any OS, Linux can be made more secure if users are aware of its vulnerabilities and keep current on new releases and fixes. It’s assumed you have some experience working with a *nix OS, so basics of the Linux OS and file system aren’t covered in this chapter. Many Linux versions are available, with differences ranging from slight to major. For example, Red Hat and Fedora Linux use the yum command to update and manage RPM packages, and Ubuntu and Debian (and the Linux version included with the BackTrack files) use the aptget command to update and manage DEB packages. Whatever Linux version you use, it’s important to understand the basics, such as run control and service configuration, directory structure, file system, basic shell commands and scripting, and package management. (If you’re unfamiliar with these *nix basics, spending some time reviewing them is highly recommended. One of the quickest ways security testers can make a poor impression on clients is to show a lack of knowledge about the systems they’re testing.)
Note Guide to Operating Systems, Enhanced Edition (Michael Palmer, Course Technology, 2007, ISBN ) is highly recommended for more information on Linux as well as Windows, NetWare, and Macintosh OSs. A thorough understanding of OSs is essential for security testers.

38. Samba
Samba ( in 1992 as an open-source implementation of CIFS. With Samba, *nix servers can share resources with Windows clients, and Windows clients can access a *nix resource without realizing that the resource is on a *nix computer.
For a Windows computer to be able to access a *nix resource, CIFS must be enabled on both systems. On networks that require *nix computers to access Windows resources, Samba is often used. It’s not a hacking tool; this product was designed to enable *nix computers to “trick” Windows services into believing that *nix resources are Windows resources. A *nix client can connect to a Windows shared printer and vice versa when Samba is configured on the *nix computer. Most new versions of Linux include Samba as an optional package, so you don’t need to download, install, and compile it.

39. Activity 8.3: Discovering Exploits for Linux Systems Time Required: 20 minutes
Objective: Research the Internet to discover Linux exploits.
Description: In this activity, you visit a Web site listing exploits you can use to attack different OSs. As a security tester, you should be aware of the resources available to both security testers and attackers.
If necessary, boot your computer into Linux with the BackTrack files. Start a Web browser and go to
On the Security Focus home page, type wireshark in the search text box at the upper right and press Enter.
Review some of the documents in the search results. Click the discussion, exploit, and solution tabs in each document to find more information. In which versions of Wireshark are vulnerabilities reported? Find at least one vulnerability for which an exploit or proof of concept (code used to demonstrate the vulnerability) has been published and included for download from the Security Focus Web site.
To determine the version of Wireshark running on your computer, open a Konsole shell, and then type wireshark and press Enter to start Wireshark.
In the Wireshark Network Analyzer window, click Help, About Wireshark from the menu. What version of Wireshark is running on your system?
Would the exploit you found in Step 3 work on your system?
Close the Wireshark Network Analyzer window and the Konsole shell, but leave your Web browser open for the next activity.

40. Checking for Trojan Programs
Most Trojan programs perform one or more of the following functions:
Allow remote administration of the attacked system
Create a file server (FTP) on the attacked computer so that files can be loaded and downloaded without the user’s knowledge
Steal passwords from the attacked system and them to the attacker
Log all keystrokes a user enters and the results to the attacker or store them in a hidden file the attacker can access remotely
One method of attacking networks remotely is installing Trojan programs that record keystrokes and other processes without users’ knowledge. Trojan programs can be installed after users click an attachment to an , or users might download a file from the Internet thinking it’s a patch or a security fix for the OS they’re running. Because the Web server logs the IP address of all visitors, when users download a file from the Internet, attackers then know the IP address of the person who downloaded the Trojan. When a Trojan is installed on a computer, it advertises information it finds to a specific port, so the attacker needs to monitor or connect to that port to gather the information. Most Trojan programs perform one or more of the following functions:
Allow remote administration of the attacked system
Create a file server (FTP) on the attacked computer so that files can be loaded and downloaded without the user’s knowledge
Steal passwords from the attacked system and them to the attacker
Log all keystrokes a user enters and the results to the attacker or store them in a hidden file the attacker can access remotely

41. Activity 8.4: Using Tools to Find Linux Rootkits Time Required: 15 minutes
Objective: Learn how to find Linux rootkits on the Internet and use a rootkit-checking program.
Description: Attackers can locate rootkits for many Linux platforms easily. In this activity, you visit the Web site, which has thousands of tools and exploits that attackers or security professionals can use. You also run a rootkit detection program included with BackTrack to find rootkits running on your system.
If necessary, boot your computer into Linux with the BackTrack files, and start a Web browser. Go to
On the home page, point to search in the navigation bar, type rootkit in the text box that’s displayed, and press Enter. At the bottom of the page, you’ll see that hundreds of results were returned for this search.
Look through the list for Linux Rootkit 5. The description shows some Linux commands that are Trojaned when using this rootkit. List five of these commands.
Open a Konsole shell, and then type chkrootkit and press Enter to check for rootkits on your system. Do you recognize any of the Linux commands you wrote down in Step 3?
Log off the BackTrack session.